user session data passed to view

[eluser]vitoco[/eluser]
i think not , if you doesn't do echo on sensible data. Remember that all the process, e.g. the session data in the view is processed in the server, not in the client, so you can pass all data needed to the view, sensible or not, but it's only a security flaw if you show it( send it to the client in the rendered html ).

if i'm wrong, please correct me.